Cicada3301 is a ransomware-as-a-service group that emerged in 2024, suspected to be a successor of BlackCat/ALPHV.
Cicada3301 is a ransomware-as-a-service group that emerged in mid-2024, suspected to be a successor of BlackCat/ALPHV. The group primarily targets Windows, Linux, and ESXi systems. Their key TTPs include Rust-based ransomware and an affiliate program with a 20% commission. Defenders should focus on Rust-based ransomware payloads, affiliate activity patterns, and indicators linked to BlackCat threat intelligence.
Cicada3301 is a ransomware-as-a-service group (tracked as Repellent Scorpius by Palo Alto) that emerged in mid-2024 using Rust-based ransomware targeting Windows, Linux, and ESXi systems, suspected to be a successor of BlackCat/ALPHV and running an affiliate program with 20% commissions.
Cicada3301 primarily targets Windows, Linux, and ESXi systems.
Cicada3301's ransomware payloads are written in the Rust programming language.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.